T09 · Insecure Skill Coding Practices
Warning
- Location
references/adapter-private-key.md:20- Finding
Bridge examples execute fund transfers without mandatory confirmation or input validation
- Content
View full analysis
- Remediation
View remediation
Security audit
Bridge Stablecoin
Security checks for vulnerabilities and agentic risk
Overview
This skill is a coherent Circle USDC bridging guide, but users should treat its examples carefully because they involve signing credentials and transaction code.
Install only if you intend to build Circle Bridge Kit/CCTP USDC transfers. Use testnets and low-balance test wallets first, keep private keys and Circle secrets out of logs and source control, pin reviewed dependency versions, and add an explicit confirmation step before any mainnet bridge transaction.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T08 · Insecure Dependencies
Note
- Location
SKILL.md:15- Finding
Security-sensitive SDK dependencies are installed without version pinning
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The description includes generic triggers such as "crosschain transfer" and "move USDC between chains" without clear activation boundaries or exclusion conditions. In a manifest-style file, these phrases are broad enough to overlap with general discussion of blockchain transfers, which can make invocation scope ambiguous.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 85% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md - NEVER hardcode, commit, or log secrets (private keys, API keys, entity secrets). ALWAYS use environment variables or a secrets manager. Add `.gitignore` entries for `.env*` and secret files when scaffolding. - NEVER pass private keys as plain-text CLI flags. Prefer encrypted keystores or interactive import. - ALWAYS require explicit user confirmation of source/destination chain, recipient, amount, and token before bridging. NEVER auto-execute fund movements on mainnet. - ALWAYS warn when targeting mainnet or exceeding safety thresholds (e.g., >100 USDC). - ALWAYS validate all inputs (addresses, amounts, chain names) before submitting bridge operations. - ALWAYS warn before interacting with unaudited or unknown contracts.
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The example performs an actual bridge operation that can move real USDC, but the surrounding documentation does not clearly warn that it initiates a live asset transfer or advise readers to confirm network, wallet, amount, and environment before running it. In a bridge-related skill, this is especially risky because users may copy-paste the sample and unintentionally trigger irreversible cross-chain movement of funds, particularly if production credentials are present in environment variables.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
This markdown file contains code that reads a private key from an environment variable to create a signing adapter, but the surrounding documentation does not warn users that the example requires highly sensitive credentials. Under the markdown criteria for SQP-2, skill descriptions should disclose behaviors affecting privacy or system integrity, and use of raw private keys is safety-critical.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The example initiates a bridge transaction that can move USDC between chains, which can affect user funds and may be irreversible if misconfigured. The markdown description presents this as a reference implementation but does not include any warning about transaction costs, testnet/mainnet context, or the consequences of executing a transfer.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
This example reads both EVM and Solana private keys from environment variables, but the markdown provides no explicit warning about safeguarding those secrets. Because compromise of either key could enable unauthorized transactions, the documentation should clearly disclose the sensitivity of these inputs.
- Content